Automating Trivy Container and Lockfile Vulnerability Scans
Modern software development relies heavily on open-source dependencies. A standard React application easily pulls hundreds of transitive npm packages into its dependency tree, while containerized CI pipelines execute within Docker base images containing system libraries, C compilers, and utility runtimes.
Every external dependency introduces potential security risk. Unpatched vulnerabilities, compromised sub-packages, and outdated libraries can expose systems to remote code execution or prototype pollution. To detect and remediate these threats automatically, our Woodpecker CI pipeline executes Aqua Security Trivy on every build.
Trivy is an advanced, open-source vulnerability scanner designed for container images and filesystems. In our continuous integration workflow, Trivy runs in filesystem (`fs`) mode against the repository root.